NEAS[.]35825139882fe6ca0d94e357012ca740[.]exe | Triage

Sharing

General

Target

NEAS.35825139882fe6ca0d94e357012ca740.exe
Size

119KB
MD5

35825139882fe6ca0d94e357012ca740
SHA1

dfa95dd5f906fa757f41e3aee11cbc6d27b5eb7c
SHA256

2d4465d4ab38c1783abadffa96567e79145d22d42e1e834dc56203fd459c10c9
SHA512

82c92a52ad82a610cea001d1b0e8426f3a23d1ec000e044fb3ec8553282cb92b6f35e794495c26d8887fe627561bedb63d2360cf9dd8bdf8f5b8c2e8045f55a4
SSDEEP

3072:yEyHrgBEo8OcvAJI5LlVwa1yuv2fdXyRik:y1MBEEJIFvDywSdXcik

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.35825139882fe6ca0d94e357012ca740.exe

Files

NEAS.35825139882fe6ca0d94e357012ca740.exe
.exe windows:4 windows x86 arch:x86

bbe3c2e1d9fd3e8a44b61308e26cb357

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemPowerStatus
GetFileSizeEx
TermsrvGetWindowsDirectoryA
OpenWaitableTimerA
RegDeleteKeyExA
WerRegisterMemoryBlock
EnumCalendarInfoExW
CreateThreadpool
Wow64SetThreadContext
CreatePrivateNamespaceW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE